chore(deps): Bump the minor-and-patch group with 9 updates

[dependabot]

Bumps the minor-and-patch group with 9 updates:

Package	From	To
eslint-plugin-solid	0.18.0	0.18.1
jsdom	30.1.1	30.1.2
oxlint	1.86.0	1.87.0
playwright	1.63.0	1.64.0
publint	0.3.24	0.3.25
vite	8.3.1	8.3.3
@solidjs/start	2.0.5	2.0.6
@shikijs/rehype	4.4.3	4.5.0
shiki	4.4.3	4.5.0

Updates eslint-plugin-solid from 0.18.0 to 0.18.1

Release notes

Sourced from eslint-plugin-solid's releases.

v0.18.1

Bug-fix patch release. Thanks @​thedanchez for the detailed reports (#233, #234, #235), @​brenelz for #230, and @​milomg for #228.

solid/reactivity

• dynamic() sources from @solidjs/web are now tracked scopes, like createMemo — async sources included (#230 by @​brenelz; fixes item 1 of #235).
• Optional callback properties wrapped in a conditional or logical expression ({ onDrag: props.onDrag ? (e) => props.onDrag(e) : undefined }) now classify like the unconditional property form instead of reporting badUnnamedDerivedSignal (#235 item 2).
• .then()/.catch()/.finally() callbacks are treated as called functions, like timer callbacks and code after await (#235 item 3).

solid/no-unused-signal

• Function-form derived primitives (createSignal(fn), createStore(fn, seed)) are no longer reported as "never written" — they change through their source function (#234).
• The export exemption now applies only to the exported declaration itself, so signals inside export function Component() {} are checked again; export const [a, setA] = createSignal(0) stays exempt (#234).

Types

• Public exports are now assignable to ESLint's defineConfig() from eslint/config: the plugin's rules are declared with a loose structural type at the export boundary (mirroring typescript-eslint's workaround for typescript-eslint#11543), and configs validate against ESLint's own Linter.Config. Runtime unchanged; a type-level test now guards this in CI (#233).

eslint-solid-standalone

• The Linter instance sets cwd: "/", needed by solid-playground (#228 by @​milomg).

Commits

• 253c3a9 Merge 0.18.1: reactivity FP fixes (conditional callback properties, promise c...
• 218eb11 chore: release 0.18.1
• 9e6f4db types: make public exports assignable to ESLint defineConfig() (fixes #233)
• 3052040 reactivity: stop reporting conditionally-set callback properties and promise ...
• 9f87996 no-unused-signal: skip neverWritten for function-form derived primitives; exe...
• 2d8f284 Merge pull request #225 from solidjs-community/dependabot/npm_and_yarn/vitest...
• 95190b3 Merge pull request #228 from milomg/patch-1
• cea2426 Merge pull request #230 from brenelz/fix/reactivity-dynamic
• 9a8f5fb fix(reactivity): allow async dynamic sources
• 0eff12b fix(reactivity): treat dynamic's source function as a tracked scope
• Additional commits viewable in compare view

Updates jsdom from 30.1.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

Commits

• a23bfb7 30.1.2
• 64a75d2 Update dependencies and dev dependencies
• 7bf9653 Invalidate styles after CSSOM and control state changes
• fe9009c Update focused area handling
• a8d28b3 Release windows retained by stylesheet parsing
• 05a2c01 Deduplicate generated CSS property metadata
• 1efa190 Reduce generated CSS property data
• a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
• b2cd235 Update css-color
• 0542d2b Release idle MutationObserver bookkeeping
• Additional commits viewable in compare view

Updates oxlint from 1.86.0 to 1.87.0

Release notes

Sourced from oxlint's releases.

oxlint v1.87.0

🚀 Features

• 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
• cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
• 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

• 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
• 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
• 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
• 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
• e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
• 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
• f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
• 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)
• ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Updates playwright from 1.63.0 to 1.64.0

Release notes

Sourced from playwright's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates publint from 0.3.24 to 0.3.25

Release notes

Sourced from publint's releases.

publint@0.3.25

Patch Changes

• #260 54aebea - Fix FILE_INVALID_JSX_EXTENSION not detecting the .ctsx extension

• #265 78604f3 - Skip file existence check for browser field values that point at another package

Changelog

Sourced from publint's changelog.

0.3.25

Patch Changes

• #260 54aebea - Fix FILE_INVALID_JSX_EXTENSION not detecting the .ctsx extension

• #265 78604f3 - Skip file existence check for browser field values that point at another package

Commits

• b994a03 Release packages (#261)
• 247be99 Update dependencies (#266)
• 78604f3 Skip file check for browser field values that point at another package (#265)
• 54aebea Fix FILE_INVALID_JSX_EXTENSION not detecting the .ctsx extension (#260)
• See full diff in compare view

Updates vite from 8.3.1 to 8.3.3

Release notes

Sourced from vite's releases.

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

Changelog

Sourced from vite's changelog.

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

Commits

• fea5b21 release: v8.3.3 (#23657)
• c3e06f9 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• ba8b7ab fix(server): check fs.serve for ?vite-wasm-instance (#23655)
• 22fd1d5 fix(deps): update launch-editor to v2.14.2 (#23654)
• 7dafd8e fix(html): filename passed to transformIndexHtml should not include queries (...
• 1003321 release: v8.3.2 (#23623)
• 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
• 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
• 89574f6 perf: avoid encoding intermediate source maps (#23461)
• 5a3a010 fix(server): release previous environments after initialization (#23499)
• Additional commits viewable in compare view

Updates @solidjs/start from 2.0.5 to 2.0.6

Release notes

Sourced from @​solidjs/start's releases.

@​solidjs/start@​2.0.6

Patch Changes

• a4ed2a4: Stop client-only from failing the build for lazily imported client components.

  A module that imported client-only and was loaded through clientOnly(() => import(...)) failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the client-only module and rejected it, though that module never runs on the server. client-only no longer fails the build. server-only is unchanged and still fails a client build.

• 048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form.

  A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a FormData as the last argument. Building the flash cookie called .entries() on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path.

• 59e7dc7: Make reading server function streams safer and faster.

  • A malformed chunk after the first one is now logged instead of causing an unhandled promise rejection. On hosts that do not catch unhandled rejections, one bad request could stop the server process.
  • The stream is cancelled when a chunk cannot be read or parsed.
  • Chunk headers are now checked strictly, and a server rejects chunks over 64MB that a client sends.
  • Large payloads that arrive in many small pieces are read in linear time. A 16MB chunk read in 16KB pieces took about 2 seconds and now takes about 30ms.

• d34acf5: Require seroval and seroval-plugins 1.6.8 or newer.

• d34acf5: Send Cache-Control: no-store on server function responses by default.

  Server function responses, including calls made with GET, carried no Cache-Control, so a shared cache configured to store them could serve one caller's result to another. Every response from the server function handler now defaults to no-store: results, errors, redirects, no-JS redirects, raw Response passthroughs, and the handler's own refusals. A Cache-Control the function sets itself, on a returned Response or on the event's response headers, is kept as is, and a 304 is never given one.

• d34acf5: Reject cross-site server function requests.

  A "use server" function could be invoked from another site with the visitor's cookies, over a GET or a form POST, because the request's origin was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the Sec-Fetch-Site header and falls back to comparing Origin against the request host, so a page on another site receives a 403 instead of running the function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS.

• 9d3cbec: Report server functions that cannot work instead of compiling them into broken output.

  • A "use server" function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs.
  • The same check covers this and arguments in an arrow function, super, and private class members.
  • A "use server" directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser.
  • A "use server" string that is not the first statement of a module or a function body now logs a warning. It has no effect there.
  • An export a "use server" module cannot serve now logs a warning that names it. These exports are still left out of the client build.
  • A "use server" module can now export an anonymous default function. Both export default async () => {} and export default async function () {} work.
  • Server function ids are now built from the names a function is nested under, such as Page.load, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque.
  • Server functions are now compiled in .mts and .cts files.
  • Build errors now point at the full path of the file, not just its name.

• d34acf5: Treat a server function request with Origin: null and no Sec-Fetch-Site as cross-site.

  Browsers send Origin: null from opaque origins, such as sandboxed iframes and some cross-origin redirect chains. When Sec-Fetch-Site was absent, the handler skipped the Origin comparison for that value and allowed the request. It is now refused with a 403. Requests that carry neither header, such as those from non-browser clients, are still allowed.

• d34acf5: Settle server function values that are still waiting on the stream when its body ends.

  A seroval body can reference a promise or stream that a later frame settles. If the body ended before that frame arrived, the value stayed pending forever, so a server function awaiting such an argument never answered. A malformed later frame also surfaced as an unhandled rejection. When the body ends or fails, every promise still waiting on it now rejects (with the failure, or with "Server function stream ended unexpectedly.") and every open stream errors. Decoded promises that nobody awaits no longer report unhandled rejections; code that awaits them still sees the rejection.

Changelog

Sourced from @​solidjs/start's changelog.

2.0.6

Patch Changes

• a4ed2a4: Stop client-only from failing the build for lazily imported client components.

  A module that imported client-only and was loaded through clientOnly(() => import(...)) failed the server build, even though it only ever runs in the browser. The server build resolves every dynamic import to emit its chunk, so it resolved the client-only module and rejected it, though that module never runs on the server. client-only no longer fails the build. server-only is unchanged and still fails a client build.

• 048f5a9: Stop a no-JS server function POST from returning a 500 when the body is not a form.

  A POST to a server function without the client runtime, carrying an empty body or a non-form content type, left a value that is not a FormData as the last argument. Building the flash cookie called .entries() on it and threw, and the error handler rethrew the same way, so the request failed with a 500. The response is now the normal redirect, and the flash cookie is best effort so it can no longer take down the error path.

• 59e7dc7: Make reading server function streams safer and faster.

  • A malformed chunk after the first one is now logged instead of causing an unhandled promise rejection. On hosts that do not catch unhandled rejections, one bad request could stop the server process.
  • The stream is cancelled when a chunk cannot be read or parsed.
  • Chunk headers are now checked strictly, and a server rejects chunks over 64MB that a client sends.
  • Large payloads that arrive in many small pieces are read in linear time. A 16MB chunk read in 16KB pieces took about 2 seconds and now takes about 30ms.

• d34acf5: Require seroval and seroval-plugins 1.6.8 or newer.

• d34acf5: Send Cache-Control: no-store on server function responses by default.

  Server function responses, including calls made with GET, carried no Cache-Control, so a shared cache configured to store them could serve one caller's result to another. Every response from the server function handler now defaults to no-store: results, errors, redirects, no-JS redirects, raw Response passthroughs, and the handler's own refusals. A Cache-Control the function sets itself, on a returned Response or on the event's response headers, is kept as is, and a 304 is never given one.

• d34acf5: Reject cross-site server function requests.

  A "use server" function could be invoked from another site with the visitor's cookies, over a GET or a form POST, because the request's origin was not checked. Requests to server functions are now allowed only from the same origin or same site. The check trusts the Sec-Fetch-Site header and falls back to comparing Origin against the request host, so a page on another site receives a 403 instead of running the function. Same-origin calls, user-initiated navigations, and no-JS form submissions are unaffected. A separate origin that needs to call your backend should use an API route with explicit CORS.

• 9d3cbec: Report server functions that cannot work instead of compiling them into broken output.

  • A "use server" function that reads a variable from an enclosing function now fails the build. The function is moved to the top level of its module, so the variable is not in scope when it runs.
  • The same check covers this and arguments in an arrow function, super, and private class members.
  • A "use server" directive in an object or class method now fails the build. It was ignored before, which shipped the method body and the modules it imports to the browser.
  • A "use server" string that is not the first statement of a module or a function body now logs a warning. It has no effect there.
  • An export a "use server" module cannot serve now logs a warning that names it. These exports are still left out of the client build.
  • A "use server" module can now export an anonymous default function. Both export default async () => {} and export default async function () {} work.
  • Server function ids are now built from the names a function is nested under, such as Page.load, instead of the order the functions appear in. An id no longer changes when another server function is added to the same file, and two functions that share a name are told apart by the names around them. Production ids stay opaque.
  • Server functions are now compiled in .mts and .cts files.
  • Build errors now point at the full path of the file, not just its name.

• d34acf5: Treat a server function request with Origin: null and no Sec-Fetch-Site as cross-site.

  Browsers send Origin: null from opaque origins, such as sandboxed iframes and some cross-origin redirect chains. When Sec-Fetch-Site was absent, the handler skipped the Origin comparison for that value and allowed the request. It is now refused with a 403. Requests that carry neither header, such as those from non-browser clients, are still allowed.

• d34acf5: Settle server function values that are still waiting on the stream when its body ends.

  A seroval body can reference a promise or stream that a later frame settles. If the body ended before that frame arrived, the value stayed pending forever, so a server function awaiting such an argument never answered. A malformed later frame also surfaced as an unhandled rejection. When the body ends or fails, every promise still waiting on it now rejects (with the failure, or with "Server function stream ended unexpectedly.") and every open stream errors. Decoded promises that nobody awaits no longer report unhandled rejections; code that awaits them still sees the rejection.

Commits

• 9b943dc chore: release (#2324)
• 59e7dc7 fix(fns): harden and speed up the server function chunk reader (#2331)
• d34acf5 fix(fns): settle pending stream values, default Cache-Control: no-store, refu...
• a4ed2a4 fix(boundary): allow client-only modules behind a lazy import (#2325)
• 048f5a9 fix(fns): guard the no-JS flash cookie against non-form arguments (#2320)
• 9d3cbec fix(directives): report server functions that cannot work (#2318)
• 378cbcd fix(fns): reject cross-site server function requests (#2321)
• See full diff in compare view

Updates @shikijs/rehype from 4.4.3 to 4.5.0

Release notes

Sourced from @​shikijs/rehype's releases.

v4.5.0

   🚀 Features

• Emit an explicit color level from codeToANSI  -  by @​EvanProgramming in shikijs/shiki#1320 (b968e)
• transformers:
  • Add classActiveCode option to transformerNotationWordHighlight  -  by @​curiouscoder-cmd in shikijs/shiki#1201 (1e968)
  • Add transformerRenderLineNumber  -  by @​Divyapahuja31 and DIVYA PAHUJA in shikijs/shiki#1238 (02f05)

   🐞 Bug Fixes

• cli:
  • Fall back to 'text' when file/URL has no extension and no -…  -  by @​VeerShah41 in shikijs/shiki#1248 (c00e5)
  • Fall back to plaintext for unknown languages  -  by @​Jinjiang and @​antfubot in shikijs/shiki#1319 (4eb7c)
• primitive:
  • Dispose wasm memory for lazily embedded langs  -  by @​rgodha24 in shikijs/shiki#1322 (b5423)
  • Dedupe grammar injections on repeated language loads  -  by @​antlio and @​antfubot in shikijs/shiki#1318 (33678)
• stream:
  • Compile Solid renderer with babel-preset-solid  -  by @​BetterAndBetterII and @​antfu in shikijs/shiki#1309 (8724e)
• transformers:
  • Keep notations on content comment lines  -  by @​tianrking in shikijs/shiki#1308 (d25ab)
  • Handle split # and -- comments in rose-pine theme  -  by @​anandghegde in shikijs/shiki#1317 (63e6d)
• twoslash:
  • Avoid crash when @​errors nodes land past EOF  -  by @​Yahiro025, @​cursoragent and @​antfubot in shikijs/shiki#1316 (5c919)

   🏎 Performance

• engine-js: Reuse each regex's last search while tokenizing a line  -  by @​issacgerges and @​antfu in shikijs/shiki#1314 (2ef5e)
• stream: Group tokens by line in the React renderer  -  by @​CNSeniorious000 in shikijs/shiki#1311 (81200)
• vitepress-twoslash: Replace lz-string with lz-string-es  -  by @​antfubot in shikijs/shiki#1324 (2e170)

    View changes on GitHub

Commits

• f7d0167 chore: release v4.5.0
• See full diff in compare view

Updates shiki from 4.4.3 to 4.5.0

Release notes

Sourced from shiki's releases.

v4.5.0

   🚀 Features

• Emit an explicit color level from codeToANSI  -  by @​EvanProgramming in shikijs/shiki#1320 (b968e)
• transformers:
  • Add classActiveCode option to transformerNotationWordHighlight  -  by @​curiouscoder-cmd in shikijs/shiki#1201 (1e968)
  • Add transformerRenderLineNumber  -  by @​Divyapahuja31 and DIVYA PAHUJA in shikijs/shiki#1238 (02f05)

   🐞 Bug Fixes

• cli:
  • Fall back to 'text' when file/URL has no extension and no -…  -  by @​VeerShah41 in shikijs/shiki#1248 (c00e5)
  • Fal...

    Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
solid-route-progress	Ready	Preview	Oct 11, 2026 1:47am UTC